Security

Uploaded client documents are stored in private object storage, not as database blobs or public web folders.

Downloads are served through signed temporary URLs. Files are not exposed through permanent public links.

Each firm works inside its own workspace. Staff roles control who can manage clients, documents, settings, and billing.

Users only see data for workspaces they belong to.

Client upload links can expire, be disabled, restrict file type and size, and are rate limited to reduce abuse.

Upload events are recorded in activity logs so your team can see when proof was received.

The application uses security headers, login throttling, file validation, activity logs, and private storage buckets.

Reminder sends, document uploads, and key user actions are logged for audit visibility.

If you believe you have found a security issue, email hello@complychaseai.com with steps to reproduce, affected URLs, and potential impact.

Please do not publicly disclose issues until we have had a reasonable opportunity to investigate and remediate.

Security contact file: https://complychaseai.com/.well-known/security.txt